Main Page

Introduction While talking with a friend he recently mentioned having found a suspicious process running on his server.

Introduction There have been a lot of open source atteptms to creating something like strace for Windows.

Everything in this post was done on a Windows 10 22H2 machine.

The API Just a quick post about something I found quite interesting.

The Crash This all began when I was playing around with the PE file format and ended up tinkering with the loading process of drivers.

Observations In the world of privlige escalation, 3rd party elevated service programs are espically interesting to look at.

Research Drivers commanly use IOCTLs for communication from user and kernel mode, but what really goes on behind the scene.

Discovery Qualcomm has a serivce program named AdminService.exe which runs on Windows machines with the Qualcomm Atheros QCA61x4 Bluethooth device.

SoftEther VPN is a VPN program by the university of Tsukba in Japan.

Lately I’ve been digging into driver exploitation in Windows.